Reputational Risk Management in Financial Institutions

Transcription

1 Reputational Risk Management in Financial Institutions Reputational risk management across the world a survey of current practices Prof. Dr. Thomas Kaiser Frankfurt a. M.,

2 Background of the Reputational Risk Survey Reputational Risk (RepRisk) can be defined as the risk of unexpected losses due to stakeholder reactions triggered by changed perception of a company. The list of stakeholders comprises amongst others customers, employees, counterparties, shareholders and regulators. KPMG has conducted a survey amongst the Global Systemically Important Banks (G-SIBs) in late 2013 and early Out of the 28 G-SIBs, as of March 2014 responses for nine have been collected. They cover all major geographical areas (Europe, North America and Asia) to a similar degree. Due to the relatively small number of responses, the survey should not be seen as fully representative. Also a differentiation of the results by region was not feasible. The results of this global Survey have been compared to those of a broader, but geographically more focused KPMG reputational risk study which was conducted and published in This latter survey also aimed to illustrate the current state and planned activities of reputational risk management, but with only leading German financial institutions as its foundation. The questionnaire has been completed by 18 institutions out of the 23 firms that were asked to participate. Thirteen participants belong to the 20 biggest banks in Germany, while the remaining five were made up of medium-sized banks and building societies. Due to the financial crisis, regulators start to have a closer look at RepRisk management. 1

3 Loss of reputation Consequential risks from reputational risk, mainly business, liquidity and operational risk Reputational Risk on a Map of Risk Types Due to the interdependencies with operational risk and other risk types, reputational risk should be treated in a comprehensive manner. Credit Risk Loss resulting from defaults Market Risk Trading loss Operational Risk Liquidity Risk Business Risk Loss resulting from operational failures Loss due to liquidity shortage Loss of customers / business Reputational Risk 2

4 Question 1: How did you define RepRisk? (Global and German Study) As a basis for managing reputational risk, this risk type has to be clearly defined, including boundaries to other risk types. At the time of writing there is no market standard for this. Two thirds of the surveyed institutions define reputational risk as an independent risk category both for the G-SIBs as well as for the German study. The majority of the remaining third define reputational risk as consequential risk. It is recommended therefore that attention be paid to reputational risk as a trigger of other risks. 80% 60% 40% 20% 0% As a risk type of its own As a consequencial risk As a trigger to other risks Not explicitly defined so far Global Banks German Banks 3

5 Question 2: Did you classify RepRisk as material in your risk inventory? (German Study) According to the revision of the German Minimum Requirements for Risk Management (MaRisk) dated banks have to conduct a risk inventory. This includes classifying materiality of the risk types assessed. In light of the financial crisis and the loss of trust associated therewith it is not surprising that the majority of banks treat RepRisk as material. 11% 28% 61% Yes No RepRisk not included in risk inventory so far 4

6 Question 3: How did you include RepRisk in the risk strategy? (German Study) A risk strategy is a starting point for managing risks effectively. The RepRisk strategy should be closely linked with the business strategy and aligned with the strategies for other risk types. The results show a tendency to include RepRisk in existing overarching risk strategies. 60% 40% 20% 0% Part of overaching risk strategy Own sub strategy for RepRisk Not yet explicitly addressed Existing Planned 5

7 Question 4: How did you create awareness for RepRisk with employees and built risk culture? (German Study) Employees at all levels have to contribute to the management of reputational risk. An appropriate risk culture and awareness amongst employees is needed for that. That necessity has been recognized by most of the polled banks and has been implemented by a variety of instruments. 60% 40% 20% 0% By mailings By trainings By online tools Existing Planned By other means Not yet explicitly addressed * * e. g. guidance on complaints management, manuals, policies, presentations to management 6

8 Management of RepRisk towards the Stakeholders The expectations of single stakeholder groups diverge, which may create reputational risk. Stakeholder Expectations (examples) Potential reputational risk Employees Salary, appreciation, career Quality issues may lead to low perception of the company Shareholders Higher share price, dividends High credit losses lead to drop in share price Creditors Good risk/return profile IT failure leads to loss of trust Customers Quality, service Bad service reduces interest by potential customers Business partners Reliance, support Erroneous contracts lead to loss in trust Competitors Fair play Unfair competition leads to reactions by competitors Social environment CSR projects, donations Misdirected CSR projects lead to negative perception Rating agencies Disclosure, communication Misleading information leads to negative perception Lobbying groups Sustainability etc Outsourcing to low-cost countries leads to reaction by lobbying groups Fund managers Higher share price, dividends Lawsuit due to misselling leads to loss in trust Regulatory authorities Compliance Breach of money laundering law leads to negative perception 7

9 Question 5: Which stakeholders did you prioritize within your RepRisk management framework? (Global and German Study) The study found that only 50 percent of the G-SIBs and 60 percent of the German banks have already prioritized their stakeholders. German banks gave the highest priority to customers whereas employees only have a low priority. The survey shows that the G-SIBs have a different point of view as they categorized not only customers, but also employees and regulators with a high priority. 0% 20% 40% 60% 80% Customers Employees Business partners Shareholders Creditors Regulators Rating agencies NGOs Others Not yet explicitly addressed High Medium Low High Medium Low Global Banks German Banks 8

10 Question 6: How did you include RepRisk in risk committees? (German Study) Reputational risk is of bankwide concern. Regular exchange across business units regarding actual events, potential risks as well as mitigation actions are thus very beneficial. In light of increased importance of risk concentrations and dependency structures in Economic Capital models a strong link to decision-making bodies is needed. 40% 20% 0% Risk In conjunction Committee for with OpRisk all risk types committee Stand-alone RepRisk committee In other committees Not yet explicitly addressed Existing Planned * * e. g. executive committee, fraud committee 9

11 Possible Organizational Structure for RepRisk Generic organizational structure Executive Vorstand Board Risk Risikokomitee Committee Business units Unit 1 Unit 2 Unit 3 Corporate communication Public relations Public affairs Internal communication Spezialabteilungen Special departments Legal / Compliance Human resources IT Marketing Business management Unternehmens - Risk controlling bereiche Reputational risk Operational Risk Market risk Credit risk Internal audit Risk management Risk control Audit 10

12 Question 7: How did you embed RepRisk into the organization? (Global and German Study) There is no common approach to the 2nd line of defence for RepRisk. As reputational risks arise often as a consequential risk of operational risks, it is not surprising that the institutions try to benefit from the effects of the synergy that would occur when embedding reputational risk within the control and management of operational risk. 80% 60% 40% 20% 0% Dedicated department Global Banks In conjunction with OpRisk In conjunction with communication In conjunction with other topics * Not yet established Dedicated department In conjunction with OpRisk German Banks In conjunction with communication In conjunction with other topics Not yet established 11

13 Question 8: How do you conduct risk identification and qualitative risk assessment? (Global and German Study) Effective management of reputational risk should be based on systematic identification and assessment of material risk. Banks have some focus on self assessments in that regard. Linking the identification and assessment of reputational risk to the instruments used for operational risk can be an option to achieve this. Stand-alone self assessment 0% 10% 20% 30% 40% 50% 60% 70% Stand-alone scenario analysis Stand-alone external assessment Part of OpRisk self assessment By other methods Not yet established Existing Planned Existing Planned Global * Banks German Banks * e.g. expert opinions, interviews with Senior Management, risk inventory, media and social media screening 12

14 Question 9: How do you record RepRisk losses? (German Study) Knowledge on materialized reputatational risk is a key ingredient to risk management. The collection of reputational risk losses/events is currently still in a development phase at some banks. Similar to operational risk, some banks see value in external loss databases as well. 40% 30% 20% 10% 0% Stand-alone internal collection Stand-alone external collection As part * of OpRisk By other means loss database Existing Planned Not yet established * e.g. collection of newspaper articles in OpRisk loss data base, social media monitoring 13

15 Question 10: How did you define materiality thresholds? (German Study) Identifying and assessing all reputational risks is neither possible nor useful. Using materiality thresholds helps to have the right focus. Only few banks have defined materiality thresholds yet, most of which are of a qualitative nature. 6% 33% 61% Quantitative (P&L impact) Qualitative / descriptive Not yet defined 14

16 Question 11: How did you implement an early warning system for RepRisk? (German Study) Eary warning systems are no yet highly prioritized by the polled banks. This might be due to the immature nature of the discipline. Also ressources are often not yet sufficient to cover those types of activities despite the value they might add. 60% 40% 20% 0% By internal risk indicators By external risk indicators (e.* g. RepRisk Index) Existing By other methods Planned Not yet established * e.g. new product process, media screening 15

17 Question 12: How did you consider RepRisk in the risk bearing capacity concept? (Global and German Study) In general, material risks have to be included in a bank s risk bearing capacity concept. Otherwise their exclusion has to be properly reasoned. The global study shows that the G-SIBs consider reputational risk as an individual buffer, but most of them have no explicit model in their risk bearing capacity. In contrast, German banks do consider reputational risks to be part of an overarching buffer. 100% 80% 60% 40% 20% 0% By stand-alone economic capital model Global Banks As add-on to other risk types As part of overarching buffer As individual buffer No explicit treatment in risk bearing capacity By stand-alone economic capital model As add-on to other risk types German Banks As part of overarching buffer As individual buffer No explicit treatment in risk bearing capacity 16

18 Question 13: How did you include RepRisk in Stress Testing? (German Study) Stress tests for reputational risk is not yet a prioritized topic in the polled banks. As reputational risk typically materializes in other risk risk types (mainly business risk, liquidity risk and operational risk), including reputational risk in the stress testing of those risk types is probably the most straightforward way of implementation. 60% 40% 20% 0% Stand-alone stress tests As a consequence of other risk types As a trigger to other risk types In inverse stress tests Not yet explicitly in included in stress test Existing Planned 17

19 Reputation management vs. RepRisk management Preventing and reacting to events that affect public opinion are part of reputational risk management. Reputation level Reputation management Reputational risk management Reputation management Target range after strategy adjustment Target range for company reputation Target range after the crisis Systematic improvement of company reputation Prevention: Avoiding the event from taking place Reaction: Lessening the effects of the event Restoration of the company reputation Time 18

20 Question 14: How did you include RepRisk in risk management/mitigation? (Global and German Study) The reputational risk management framework should focus on active management/mitigation of those risks. The majority of the German banks declared that they have defined the roles of dedicated organizational units whereas only 10% of the G-SIBs have any such defined roles, however the inclusion of reputational risk within risk management is explicitly planned in particular. Those institutions who are planning to extend their reputational risk framework intend to enhance the role of the decentralized operational risk manager, or to include reputational risk management within crisis management. 80% 60% 40% 20% 0% By defined roles of specific units Global Banks By enhanced role of decentral OpRisk managers By inclusion in crisis management No formalized management yet By defined roles of specific units German Banks By enhanced role of decentral OpRisk managers By inclusion in crisis management No formalized management yet 19

21 Question 15: In which transactions/change processs did you explicitly include RepRisk? (Global and German Study) Managing reputational risk can both occur on a portfolio level as well as on single processes or transactions. The latter enables banks to shape their business and transactions in a risk mitigating way. The survey revealed that the focus at the time it was conducted was on new product processes, credit business and outsourcing of course due to concrete regulatory requirements. Furthermore, the G-SIBs pay high attention to trading businesses, service providers 0% and projects. 20% 40% 60% 80% 100% New product process Credit business Trading business Memberships Corporate development Existing Global Banks Projects Planned Outsourcing Service providers Others Existing Planned German Banks Not yet established 20

22 Question 16: How do you report on RepRisk to Senior Management? (German Study) Results of the identification and assessment of reputational risks as well as mitigation measures should be reported to Senior Management on a regular basis. Most polled banks focus on overarching risk reports and ad-hoc reports. 50% 40% 30% 20% 10% 0% By stand-alone regular reports As part of overarching risk reports By ad-hoc reporting No formalized reporting yet Existing Planned 21

23 Question 17: Are mitigation measures being tracked/monitored? (German Study) Tracking mitigation actions and their lifecycle in a database supports judging their effectiveness as well as to ensure the actual implementation. Due to the limited maturity of the topic it is somewhat surprising to see more than a third of the polled banks having such measures in place. 50% 39% 11% Yes Planned No 22

24 Conclusion The management and controlling of reputational risks at the time of writing is in an early phase of development and there are different points of view concerning governance, methods and processes. Setting up a reputational risk management framework is difficult when questions remain over its definition and which department should be responsible. The results of the survey show that a significant number of institutions already systematically integrate reputational risk into their overall risk management, or have started to develop a risk management framework. In terms of establishing a methodology for reputational risk management, the obvious approach is for banks to utilise the tools and instruments created for operational risk management and to modify them accordingly, as demonstrated in several other chapters of this book. Firms should take advantage of the learning curve from operational risk it took operational risk eight to ten years to become a relatively mature discipline, but by using existing toolsets it should probably take reputational risk less time to mature. 23

25 Possible implementation of Reputational Risk The methods and processes of reputational risk management could be introduced gradually. Analysis of all interdependencies Reputational risk as a consequential risk Extension of existing risk management instruments Qualitative assessment of reputational risk Case-by-case mitigation actions Reputational risk as a risk type of its own Clear roles and responsibilities Establishment of dedicated methods and processes Comprehensive qualitative and, where applicable, quantitative assessment Systematic mitigation actions Extension of the instruments Consideration of the (financial) impacts of actual reputational events on other risks, e.g., liquidity Integration in all business activities (e.g., refinancing, new products) Integration in risk-return management Value for bank management Phase I Phase II Phase III Time 24